InvalidIdentityTokenException with STS Regional Endpoints in GovCloud

[Ali-Herrera]

How are you running Renovate?

Self-hosted Renovate

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

GitHub, version 39.131.0

Please tell us more about your question or problem

We are encountering an InvalidIdentityTokenException error while running Renovate on an ARC Runner inside an EKS cluster in the GovCloud partition. The error occurs when attempting to retrieve AWS machine image datasources. Below is the error message we observe:

"InvalidIdentityTokenException: No OpenIDConnect provider found in your account for https://**redacted**@[email protected]/node_modules/@aws-sdk/client-sts/dist-cjs/index.js:560:21)\n    at de_CommandError (/usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@aws-sdk/client-sts/dist-cjs/index.js:505:19)\n    at processTicksAndRejections (node:internal/process/task_queues:105:5)\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/middleware-serde/dist-cjs/index.js:35:20\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/core/dist-cjs/index.js:167:18\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/middleware-retry/dist-cjs/index.js:321:38\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:33:22\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@aws-sdk/client-sts/dist-cjs/index.js:1458:78\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]_@[email protected]/node_modules/@aws-sdk/credential-provider-web-identity/dist-cjs/fromTokenFile.js
25\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/property-provider/dist-cjs/index.js
27\n    at coalesceProvider (/usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/property-provider/dist-cjs/index.js:126:18)\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/property-provider/dist-cjs/index.js:144:18\n    at coalesceProvider (/usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/core/dist-cjs/index.js:368:18)\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/core/dist-cjs/index.js:386:18\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@smithy/core/dist-cjs/index.js:85:17\n    at /usr/local/renovate/node_modules/.pnpm/@[email protected]/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:33:22\n    at AwsMachineImageDatasource.getSortedAwsMachineImages (/usr/local/renovate/lib/modules/datasource/aws-machine-image/index.ts:91:28)\n    at /usr/local/renovate/lib/util/cache/package/decorator.ts:134:20\n    at AwsMachineImageDatasource.getReleases (/usr/local/renovate/lib/modules/datasource/aws-machine-image/index.ts:142:20)\n    at /usr/local/renovate/lib/util/cache/package/decorator.ts:134:20"

• Environment: ARC Runner inside an EKS cluster in the GovCloud partition.
• Issue: STS regional endpoints are not being properly handled, leading to an InvalidIdentityTokenException.
• Temporary Fix: Reverting to version 36.0.0 of Renovate resolves the error but introduces a new issue where AMIs are not properly differentiated for us-gov-west-1 and us-gov-east-1.
• Current Version: 39.131.0 fails with the error mentioned above.

Details on Fix
Adding the following configuration in the fromNodeProviderChain({ profile }) call in lib/modules/datasource/aws-machine-image/index.ts fixes the issue:

clientConfig: { region }

• minimal-reproduction: github.com/herrera-alison/minimal-reproduction-ami

Logs (if relevant)

Logs

Replace this text with your logs, between the starting and ending triple backticks